CVE-2024-57437
📋 TL;DR
RuoYi v4.8.0 contains a SQL injection vulnerability in the orderby parameter at the /monitor/online/list endpoint. This allows attackers to execute arbitrary SQL commands on the database. Organizations using RuoYi v4.8.0 for system monitoring are affected.
💻 Affected Systems
- RuoYi
📦 What is this software?
Ruoyi by Ruoyi
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data manipulation, or full system takeover via subsequent attacks.
Likely Case
Unauthorized data access, privilege escalation, or extraction of sensitive information from the database.
If Mitigated
Limited impact with proper input validation and database permissions restricting damage to non-critical data.
🎯 Exploit Status
Exploitation requires access to the vulnerable endpoint, which typically requires authentication in RuoYi.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
Check the official RuoYi repositories for updates. If a patch is released, update to the fixed version following standard upgrade procedures.
🔧 Temporary Workarounds
Input Validation Filter
allImplement strict input validation for the orderby parameter to allow only safe characters.
Modify the controller handling /monitor/online/list to validate orderby parameter against a whitelist of allowed values
WAF Rule
allDeploy a web application firewall rule to block SQL injection patterns in the orderby parameter.
Configure WAF to detect and block SQL injection patterns in orderby parameter at /monitor/online/list
🧯 If You Can't Patch
- Restrict access to the /monitor/online/list endpoint using network controls or authentication requirements.
- Implement database-level protections such as least privilege accounts and query logging.
🔍 How to Verify
Check if Vulnerable:
Test the /monitor/online/list endpoint with SQL injection payloads in the orderby parameter and observe database errors or unexpected behavior.Check Version:
Check the RuoYi version in the application interface or configuration files.Verify Fix Applied:
After applying fixes, retest with SQL injection payloads to confirm they are properly rejected or sanitized.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Error messages containing SQL syntax from the application
Network Indicators:
- HTTP requests to /monitor/online/list with suspicious orderby parameter values
SIEM Query:
source="web_logs" AND uri="/monitor/online/list" AND (orderby CONTAINS "UNION" OR orderby CONTAINS "SELECT" OR orderby CONTAINS "--")